Risk
12/30/2010
11:36 AM
George V. Hulme
George V. Hulme
Commentary
50%
50%

Meet The "SMS of Death"

If a pair of German security researchers are correct, a successful SMS attack could cripple vast segments of mobile networks.

If a pair of German security researchers are correct, a successful SMS attack could cripple vast segments of mobile networks.The research, presented by Collin Mulliner and Nico Golde at the Chaos Computer Club Congress in Berlin. As reported by the site Switched:

The pair reportedly discovered it after setting up their own private GSM network, which allowed them to send malicious text messages to a variety of basic cell phones. The most serious vulnerability, the so-called 'SMS of Death,' affected several popular models from Nokia, Sony Ericsson, Samsung, LG and Motorola. The impact, however, varied from brand to brand.

In some cases, the malicious texts caused the phones to shut down, and disconnect from their networks. In the worst case, the payload-equipped SMS could force the phone to shut down and disconnect, without even registering the original message. Under these circumstances, the hacker could even force the network to send the message again, once the system re-boots, thereby trapping the phone in a vicious shutdown cycle. Mulliner and Golde emphasized that these vulnerabilities likely exist in many other mobile models, but that their work has been focused exclusively on the most popular.

That's a nasty attack by itself, and could be even worse if such a denial-of-service attack were launched simultaneously with some other event or attack.

It's been a nasty week for mobile phone security, and many predict 2011 will prove to be an ugly year for keeping smartphones and mobile gadgets secure.

Earlier today Alison Diana reported on a new Trojan that is targeting Android phones. The Trojan, dubbed Geinimi, has both botnet characteristics and can lift a significant amount of data from the device. Diana's story is worth a read.

For my security and technology observations throughout the day, find me on Twitter.

Comment  | 
Print  | 
More Insights
Register for Dark Reading Newsletters
White Papers
Cartoon
Current Issue
Flash Poll
Video
Slideshows
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2015-4692
Published: 2015-07-27
The kvm_apic_has_events function in arch/x86/kvm/lapic.h in the Linux kernel through 4.1.3 allows local users to cause a denial of service (NULL pointer dereference and system crash) or possibly have unspecified other impact by leveraging /dev/kvm access for an ioctl call.

CVE-2015-1840
Published: 2015-07-26
jquery_ujs.js in jquery-rails before 3.1.3 and 4.x before 4.0.4 and rails.js in jquery-ujs before 1.0.4, as used with Ruby on Rails 3.x and 4.x, allow remote attackers to bypass the Same Origin Policy, and trigger transmission of a CSRF token to a different-domain web server, via a leading space cha...

CVE-2015-1872
Published: 2015-07-26
The ff_mjpeg_decode_sof function in libavcodec/mjpegdec.c in FFmpeg before 2.5.4 does not validate the number of components in a JPEG-LS Start Of Frame segment, which allows remote attackers to cause a denial of service (out-of-bounds array access) or possibly have unspecified other impact via craft...

CVE-2015-2847
Published: 2015-07-26
Honeywell Tuxedo Touch before 5.2.19.0_VA relies on client-side authentication involving JavaScript, which allows remote attackers to bypass intended access restrictions by removing USERACCT requests from the client-server data stream.

CVE-2015-2848
Published: 2015-07-26
Cross-site request forgery (CSRF) vulnerability in Honeywell Tuxedo Touch before 5.2.19.0_VA allows remote attackers to hijack the authentication of arbitrary users for requests associated with home-automation commands, as demonstrated by a door-unlock command.

Dark Reading Radio
Archived Dark Reading Radio
What’s the future of the venerable firewall? We’ve invited two security industry leaders to make their case: Join us and bring your questions and opinions!